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-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 
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- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 

- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent terni adjustment. See 37 CFR 1.704(b). 

Status 

1 )13 Responsive to communication{s) filed on 12 November 2003 . 
2a)^ This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal nnatters, prosecution as to the nnerits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Clainns 

4) ^ Claim(s) 33-54 is/are pending in the application. 

4a) Of the above clainn(s) is/are withdrawn from consideration. 

5) \Z\ Claim(s) is/are allowed. 

6) ^ Claim(s) 33-54 is/are rejected. 

Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirennent. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) 0 The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
Priority under 35 U.S.C. §§119 and 120 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
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Certified copies of the priority documents have been received. 

Certified copies of the priority documents have been received in Application No. . 
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Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

13) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application) 

since a specific reference was included in the first sentence of the specification or in an Application Data Sheet, 
37 CFR 1.78. 

a) D The translation of the foreign language provisional application has been received, 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 since a specific 

reference was included in the first sentence of the specification or in an Application Data Sheet, 37 CFR 1.78. 
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Application/Control Number: 09/356,940 
Art Unit: 2621 

DETAILED ACTION 

1. This Office Action is responsive to the applicant's remarks received on November 
12, 2003. Claims 33-54 remain pending. 

Claim Rejections - 35 USC §112 
(Repeated verbatim from the previous Office Action witli one exception^) 

2. The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification sliall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of carrying out his invention. 

3. Claims 33-52 are rejected under 35 U.S.C. 1 12, first paragraph, as failing to 
comply with the written description requirement. The claim(s) contains subject matter 
which was not described in the specification in such a way as to reasonably convey to 
one skilled in the relevant art that the inventor(s), at the time the application was filed, 
had possession of the claimed invention. 

All pending claims are not original. Independent claims 33 and 45 recite a 
method of associating a plurality of random numbers with indicia that is not supported 
by the original disclosure (i.e., specification, claims, abstract and drawings). 
Independent claim 33 will be used to exemplify the non-supported subject matter. 
Given that independent claim 45 recites equivalent non-supported subject matter, it too 
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^ In the opening sentence, claims "33-52" are rejected, not 38-52 as previously indicated. This was a 
typographical error, as it was clear from the body of the rejection that claims 38-52 were rejected. 
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is rejected on the same grounds. Claims 34-44 and 46-52 are rejected as depending 
from these claims. 

Independent claim 33, at steps g and h, recites (in part, with emphasis added): 



... permitting said individual to store in said data storage source a 
plurality of indicia each one of which is representative of a secured site; 
and 

password circuitry for generating a plurality of passwords, wherein 
each of said plurality of passwords is uniquely associated with a 
respective one of said plurality of indicia" 

The scope of these claim elements cover the storage of a plurality of indicia before the 
generation of any passwords. Then, after the plural indicia are stored, the passwords 
are generated. Following the generation of the passwords, they are then associated 
with the indicia all at once. However, the specification and original disclosure describes 
a process of storing a single indicia, generating a single password, and then associating 
that single password with that indicia. While, according to the original disclosure, the 
process can be repeated for additional indicia one at a time (i.e., in series; refer to 
specification page 7, top paragraph), the original disclosure does not support 
associating plural passwords with plural indicia all at once (i.e., in parallel). 
Independent claim 45 recites equivalent limitations at steps c and d. 

Note that independent claim 53 is not rejected because step d requires the steps 
of associating a password with an indicia is performed "in sequence" at step d. This is 
supported by the original disclosure. 



# 
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Claim Rejections - 35 USC § 103 



4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 



5. Claims 45-48 and 53 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over the combination of Mcintosh (GB 2,274,184 A) and He (US 5,944,824 A). This 
rejection is repeated herein verbatim from the previous Office Action, 



Regarding claims 45 and equivalent claim 53, Mcintosh discloses: 
a portable body member (figure 1, numeral 5); 
a data storage in the body (figure 2, numeral 40); 

a user interface and communication components (figure 1, numerals 10, 15, 20 
and 25) permitting an individual to store plural indicia representative of a secure site in 
the storage ("letters" at page 2, line 44; e.g., "BC" at page 3, line 39); and 

password circuitry for allowing a user to generate a plurality of random 
passwords, wherein each password is uniquely associated with a respective one of the 
indicia ("sequence of numbers" at page 2, line 45; e.g., "1234" at page 3, line 42; in the 
example given by Mcintosh at page 3, lines 25-44, the indicia "BC" is uniquely 
associated with the password "1234"; the input keys, along with their control circuitry 



Mcintosh: 
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and the memory 40, is circuitry that allows for the generation of passwords by a user; 
Mcintosh anticipates the generation of random passwords, as the user may enter any 
password desired; even in the example at page 3, the password exemplified is "say 
1234" at line 42, which is random). 

Regarding claim 53 specifically, the steps of associating a password with an 
indicia can be repeated by a user as many times as desired as permitted by the 
memory capacity of the memory device ("... entered and recorded in like manner if so 
desired" at page 4, line 1 ). 

Regarding claim 46, indicia selection circuitry is disclosed (figure 4, "punch in 
account designation"). 

Regarding claim 47, recall circuitry is disclosed (figure 4, "pin number"). 

Regarding claim 48, a display is disclosed (figure 1, numeral 15). 

Differences: 

While Mcintosh uniquely associates a user-entered random password with a 
respective one of the indicia, and while Mcintosh teaches a random number generator 
for purposes other than generating actual passwords (i.e., "unit 55 capable of 
generating a random sequence of numbers when required" at page 3, line 14), Mcintosh 
does not disclose "password circuitry comprising a random number oenerator for 
randomly generating a plurality of passwords" . 



He: 
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He discloses a password protected secure system, where a user identifier is 
associated with a password ("user identifier and a password" at column 5, line 8), 
comprising a random number generator (figure 7, numeral 148) for randomly generating 
a password for a use to gain access to the system ("the selection of a password may be 
randomly determined" at column 7, line 58; "random selection of the password" at 
column 7, line 67). 

Obviousness Statement: 

It would have been obvious at the time the invention was made to one of ordinary 
skill in the art to add a random password generating circuit, or to modify the password 
circuitry already disclosed by Mcintosh according to the teaching of He, to generate a 
random passwords/PIN for the user for purposes of gaining access to his/her secure 
accounts so that when it comes time for the user to either choose a password, or to 
change a password, the password can be randomly generated. The above combination 
would serve to "increase the security level due to the unpredictability of the password" 
(He, column 8, line 1 ) and "for convenience and for uniqueness" (He, column 1 3, line 6), 
thus ensuring a completely random password not influenced by the knowledge of the 
user and thus making it more difficult for a hacker to predict or figure out the user's 
password, and for convenience. 
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6. Claims 45-48 and 53 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over the combination of Mcintosh (GB 2,274.184 A) and Noll et al. (US 5.732,138 A). 
This rejection is repeated herein verbatim from the previous Office Action 



Regarding claims 45 and equivalent claim 53, Mcintosh discloses: 
a portable body member (figure 1, numeral 5); 
a data storage in the body (figure 2, numeral 40); 

a user interface and communication components (figure 1, numerals 10, 15, 20 
and 25) permitting an individual to store plural indicia representative of a secure site in 
the storage ("letters" at page 2, line 44; e.g., "BC" at page 3. line 39); and 

password circuitry for allowing a user to generate a plurality of random 
passwords, wherein each password is uniquely associated with a respective one of the 
indicia ("sequence of numbers" at page 2, line 45; e.g., "1234" at page 3, line 42; in the 
example given by Mcintosh at page 3, lines 25-44, the indicia "BC" is uniquely 
associated with the password "1234"; the input keys, along with their control circuitry 
and the memory 40, is circuitry that allows for the generation of passwords by a user; 
Mcintosh anticipates the generation of random passwords, as the user may enter any 
password desired; even in the example at page 3, the password exemplified is "say 
1234" at line 42, which is random). 

Regarding claim 53 specifically, the steps of associating a password with an 
indicia can be repeated by a user as many times as desired as permitted by the 



Mcintosh: 
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memory capacity of the memory device ("... entered and recorded in like manner if so 
desired" at page 4, line 1 ). 

Regarding claim 46, indicia selection circuitry is disclosed (figure 4, "punch in 
account designation"). 

Regarding claim 47, recall circuitry is disclosed (figure 4, "pin number"). 

Regarding claim 48, a display is disclosed (figure 1, numeral 15). 

Differences: 

While Mcintosh uniquely associates a user-entered random password with a 
respective one of the indicia, and while Mcintosh teaches a random number generator 
for purposes other than generating actual passwords (i.e., "unit 55 capable of 
generating a random sequence of numbers when required" at page 3, line 14), Mcintosh 
does not disclose "password circuitry comprising a random number generator for 
randomly generating a plurality of passwords" . 

Noll et aL: 

Noll discloses a system for generating a password, wherein Noll teaches random 
number generator ("generating a random number" at column 1, line 49; "creating a 
sequence of random numbers" at column 4, line 12) for randomly generating a 
password ("passwords" at column 1 , line 23) for a use to gain access to a system 
("security system" at column 1 , line 48). 



•V, ' 
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Obviousness Statement: 

It would have been obvious at the time the invention was made to one of ordinary 
skill in the art to modify the password circuitry of Mcintosh according to the teaching of 
Noll, by including a random number generator to generate random passwords/PINs for 
the user for purposes of gaining access to his/her secure accounts so that when it 
comes time for the user to either choose a password, or to change a password, the 
password can be randomly generated. The addition of a random password generator 
as taught by Noll would serve to provide a "completely random password" which 
"presents no opening or prior knowledge that can be exploited by an hostile agent" 
(Noll, column 1, line 50). 

7. Claim 49 is rejected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of Mcintosh (GB 2,274,184 A) and He (US 5,944,824 A) as applied to claim 
47 above, and further in view of Bang (US 6,088,143 A). The rejection as advanced 
in the previous Office Action is incorporated herein by reference. Because the 
applicant in the response did not address this rejection, it will not be repeated 
herein. 



8. Claims 50-52 and 54 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over the combination of Mcintosh (GB 2,274,184 A) and He (US 5,944,824 A) as 
applied to claim 45 above, and further in view of Guthrie et al. (US 6,161,185 A). The 
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rejection as advanced in the previous Office Action is incorporated herein by 
reference. Because the applicant in the response did not address this rejection, it 
will not be repeated herein. 

9. Claims 33-36, 38, 39, 40 and 41 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over the combination of IVIclntosh (GB 2,274,184 A) and He (US 
5,944,824 A) as applied to claim 45-48 and 53 above, and further in view of 
Ramachandran (US 6,31 5,1 95 B1 ). The rejection as advanced in the previous 
Office Action is incorporated herein by reference. Because the applicant in the 
response did not address this rejection, it will not be repeated herein. 

10. Claim 37 is rejected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of Mcintosh (GB 2,274,184 A), He (US 5,944,824 A) and Ramachandran 
(US 6,315,195 B1) as applied to claim 35 above, and further in view of Bang (US 
6,088,143 A). The rejection as advanced in the previous Office Action is 
incorporated herein by reference. Because the applicant in the response did not 
address this rejection, it will not be repeated herein. 
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11. Claims 42-44 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
the combination of Mcintosh (GB 2,274,184 A), He (US 5,944,824 A) and 
Ramachandran (US 6,315,195 B1) as applied to claim 33 above, and further in view of 
Guthrie et al. (US 6,1 61 ,1 85 A). The rejection as advanced in the previous Office 
Action is incorporated herein by reference. Because the applicant in the 
response did not address this rejection, it will not be repeated herein. 



Response to Arguments 

12. Each of the remarks and/or arguments filed with the aforementioned response 
have been considered: 

Claim 112 reiections: 

Summary of Remarks (@ response page 3): "... the examiner must set forth 
express findings of fact" including, "(1) identify the claim limitations at issue; and (2) 
establish a prima facie case by providing reasons why a person skilled in the art ... 
would not have recognized that the inventor was in possession of the invention as 
claimed ..." 

Examiner's Response: Findings of fact were properly presented in the previous 
Office Action. This rejection is repeated above. Further, all claims at issue were 
identified. For example, in the rejection at paragraph 5, the following was stated: 
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"Independent claim 33 will be used to exemplify the non-supported subject 
matter. Given that independent claim 45 recites equivalent non-supported 
subject matter, it too is rejected on the same grounds. Claims 34-44 and 
46-52 are rejected as depending from these claims." 



Finally, reasons were provided. For example, in the rejection at paragraph 5, the 
following was stated: 



"The scope of these claim elements cover the storage of a plurality of 
indicia before the generation of any passwords. Then, after the plural 
indicia are stored, the passwords are generated. Following the generation 
of the passwords, they are then associated with the indicia all at once. 
However, the specification and original disclosure describes a process of 
storing a single indicia, generating a single password, and then 
associating that single password with that indicia. While, according to the 
original disclosure, the process can be repeated for additional indicia one 
at a time (i.e., in series; refer to specification page 7, top paragraph), the 
original disclosure does not support associating plural passwords with 
plural indicia all at once (i.e., in parallel)." 



Summary of Remarks (@ response page 4): "Notably, the Examiner was unable 
to point to any specific claim limitation that was not described in detail in the 
specification." 

Examiner's Response: Specific limitations were pointed to. For example, 
paragraph 5 of the rejection stated: 

"Independent claim 33, at steps g and h, recites (in part, with emphasis 
added): 



-V- • 
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... permitting said individual to store in said data storage source a 
plurality of indicia each one of which is representative of a secured site; 
and 

password circuitry for generating a plurality of passwords, wherein 
each of said plurality of passwords is uniquely associated with a 
respective one of said plurality of indicia" 

The scope of these claim elements cover the storage of a plurality 
of indicia before the generation of any passwords ..." 

Summary of Remarks (@ response page 4): "Instead, the Examiner created an 
"indefinite" limitation in an apparatus claim by construing it to recite a way of using the 
claimed invention not disclosed in hac verba in the specification." 

Examiner's Response: First, the claims are NOT rejected as being "indefinite"; 
and the examiner has "created" nothing. To the contrary, steps g and h of claim 33 are 
very definite and clear, but unsupported by the original disclosure. Further, it is the 
examiner job to "construe" claimed elements and relationships; and then to appraise the 
applicant of how those elements are construed. Should the applicant disagree with the 
manner in which the claim elements are construed, the applicant should state on the 
record how those elements should be construed. In this case, while the applicant has 
alleged that the claim were misconstrued, the applicant has not provided his own 
construction. Regarding the claims at issue, it is the examiner's contention that the 
claim construction is correct, and the claim limitations are not supported by the original 
disclosure. Further, the fact that apparatus claims are rejected under 35 USC 112. first 
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paragraph (written description requirement) is not relevant in this case. The rejected 
apparatus claims (i.e., independent claims 33 and 54) are recited as "functional" 
language, and both the "individual" functions of the apparatus elements and the 
"collective" functions of the elements (i.e., how the individual apparatus elements 
interact with one another) must be supported by the original disclosure. As described in 
the rejection, element "g" of claim 33 requires componentry that permits "said individual 
to store in said data storage source a plurality of indicia", and element "h" requires 
circuitry for "generating a plurality of passwords, wherein each of said plurality of 
passwords is uniquely associated with a respective one of said plurality of 
indicia" Thus, the functional language of the apparatus claims requires the storage of 
a "plurality of indicia" (i.e.. step g). Then, a separately claimed circuitry element 
associates "each of said plurality of passwords" with "a respective one of said plurality 
of indicia". Commensurate with the claim language chosen by the applicant, there is a 
temporal aspect to how this claim is drafted, and how it is construed. That is, by stating, 
"wherein each of said plurality of passwords is uniquely associated with a respective 
one of said plurality of indicia", this requires that a plurality of indicia be first established, 
and then each password be associated with one of the plurality of indicia in a single 
operation. This is simply not supported in the original disclosure. Again, the original 
disclosure only supports the storage and association of a password with an indicia one 
at a time. 



. v- • • 

Application/Control Number: 09/356,940 Page 15 

Art Unit: 2621 

Summary of Remarks (@ response page 4): "The rejected claims are directed to 
the structure for generating and storing random passwords ... not a method of using the 
device". 

Examiner*s Response: There are some recited structural elements in the claims. 
However, the majority of the claimed elements are defined by "functional" language 
(NOT STRUCTURAL LANGUAGE). The examiner is not rejecting the structure per se. 
Rather, it is the functional language associated with, for example, elements "g" and "h" 
of claim 33 that is at issue. 

Summary of Remarks (@ response page 4): "Thus, it is completely irrelevant 
how the device might be used . . ." 

Examiner's Response: The rejection is not based upon how the claimed 
apparatus is used. Rather, the claims define, by functional language, what the 
apparatus DOES; and it is what the claimed apparatus DOES that is lacking support in 
the original disclosure. Specifically, the claim elements cover the storage of a plurality 
of indicia before the generation of any passwords. Then, after the plural indicia are 
stored, the passwords are generated. Following the generation of the passwords, they 
are then associated with the indicia all at once. However, the specification and original 
disclosure describes a process of storing a single indicia, generating a single password, 
and then associating that single password with that indicia. While the disclosure 
contemplates repeating this process for a plurality of indicia, there is no disclosure of 
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storing a plurality of indicia, and then later, associating passwords with those indicia all 
at once. 



Summary of Remarks (@ response page 4): "Indeed, the subject matter, 
limitations, and terminology used in the claims are undoubtedly present in the 
specification". 

Examiner's Response: Where? Not a single page of the specification, a single 
drawing or an original claim is pointed to in support of this assertion. 

Prior Art Reiections: 

Claims 45-48 and 53 rejected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of Mcintosh (GB 2.274,184 A) and He (US 5.944.824 A) 

Summary of Remarks (@ response page 4): The examiner "failed to provide an 
adequate motivation or suggestion to combine", and therefore is "impermissibly applying 
hindsight analysis". 

Examiner's Response: The nature of the combination, and the motivation to 
combine was clearly laid out, and proper. Specifically, the motivation was quoted 
directly from the He reference, as follows: 



4 \^ 
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To "increase the security level due to tfie unpredictability of the password" at He 
column 8, line 1, and 

"for convenience and for uniqueness" at He column 13, line 6. 



According to MPEP 2144 (with emphasis added), 



"the rationale to modify or combine the prior art does not have to be 
expressly stated in the prior art: the rationale may be expressly or 
impliedly contained in the prior art or it may be reasoned from 
knowledge generally available to one of ordinary skill in the art, 
established scientific principles, or legal precedent established by prior 
case law. In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988); In 
re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992). See also In re 
Kotzab, 217 F.3d 1365, 1370, 55 USPQ2d 1313, 1317 (Fed. Cir. 2000) 
(setting forth test for implicit teachings); In re Eli Lilly & Co., 902 F.2d 943, 
14 USPQ2d 1741 (Fed. Cir. 1990) (discussion of reliance on legal 
precedent); In re Nilssen, 851 F.2d 1401, 1403, 7 USPQ2d 1500, 1502 
(Fed. Cir. 1988) (references do not have to explicitly suggest combining 
teachings); Ex parte Clapp, 227 USPQ 972 (Bd. Pat. App. & Inter. 1985) 
(examiner must present convincing line of reasoning supporting rejection); 
and Ex parte Levengood, 28 USPQ2d 1300 (Bd. Pat. App. & Inter. 1993) 
(reliance on logic and sound scientific reasoning)." 



"The strongest rationale for combining references is a recognition, 
expressly or impliedly in the prior art or drawn from a convincing line of 
reasoning based on established scientific principles or legal precedent, 
that some advantage or expected beneficial result would have been 
produced by their combination. In re Sernaker, 702 F.2d 989, 994-95, 217 
USPQ 1,5-6 (Fed. Cir. 1983)." 



and 



According to MPEP 2143.01 : 
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"There are three possible sources for a motivation to combine references: 
the nature of the problem to be solved, the teachings of the prior art, and 
the knowledge of persons of ordinary skill in the art." In re Rouffet, 149 
F.3d 1350. 1357, 47 USPQ2d 1453, 1457- 58 (Fed. Cir. 1998). 

Considering the very high skill level in the art, it is the examiner's contention that 
it is knowledge generally available in the art that randomly generated passwords are 
more secure, and more unique than a user generated password. This well known 
knowledge in the art would have sufficed to provide adequate motivation. However, in 
the rejection, the examiner went a step further and provided a secondary teaching that 
directly stated the obvious: i.e.. He describes randomly generated passwords "increase 
the security level due to the unpredictability of the password" (He column 8, line 1), and 
provide "for convenience and for uniqueness" (He column 13, line 6). This type of 
motivation is the strongest, and most poignant. It is the examiner's contention that the 
motivation is proper, and well founded. 

Summary of Remarks (@ response page 4): "One of ordinary skill would need to 
be motivated to add circuitry for generating random passwords". 

Examiner's Response: No and Yes. First, Mcintosh already discloses a device 
for generating random passwords as described in the rejection ("generating a random 
sequence ..." at page 3, line 14). However, the purpose of this random generator is 
different than what is claimed. That is. In Mcintosh, random passwords are generated 
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for display when an incorrect password is entered as described at page 4, line 24. In 
the rejection, and based on the motivation of He, the random generator of Mcintosh 
would be adapted to randomly generate the passwords to be associated with the indicia 
for subsequent storage. Second, even if Mcintosh didn't disclose a random number 
generator. He teaches one, with accompanying motivation for adding it to the Mcintosh 
system. 

Summary of Remarks (@ response page 5): The He reference "does not 
motivate or suggest generating randomized passwords at the user side" and "in the 
Examiner's proposed combination, a He bank server would generate a randomizing 
password 

Examiner's Response: The examiner's rejection has been misconstrued. In the 
Mcintosh and He combination, the examiner is not relying upon the "bank server" of He. 
The He reference is a "teaching", and all of the structure of He is not incorporated into 
the Mcintosh system. The test for obviousness is not whether the features of a 
secondary reference may be bodily incorporated into the structure of the primary 
reference; nor is it that the claimed invention must be expressly suggested in any one or 
all of the references. Rather, the test is what the combined teachings of the references 
would have suggested to those of ordinary skill in the art. See In re Keller, 642 F.2d 
413, 208 USPQ 871 (CCPA 1981). In the case of the Mcintosh and He combination, 
and as stated in the rejection, "it would have been obvious at the time the invention was 
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made to one of ordinary skill in the art to add a random password generating circuit, or 
to modify the password circuitry already disclosed by Mcintosh according to the 
teaching of He, to generate a random passwords/PIN for the user for purposes of 
gaining access to his/her secure accounts so that when it comes time for the user to 
either choose a password, or to change a password, the password can be randomly 
generated." 

Summary of Remarks (@ response page 7): "Moreover, this teaching [He] was 
limited to server or host-side randomizing - not randomizing by the user". 

Examiner's Response: The act of "randomizing by the user" is not a claimed 
limitation. 

Claims 45-48 and 53 reiected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of Mcintosh (GB 2,274,184 A) and Noll et al. (US 5732,138 A) 

Summary of Remarks (@ response page 7): Noll "fails to provide the necessary 
motivation to modify the structure of Mcintosh to include circuitry for generating random 
numbers for association with the indicia ..." 

Examiner's Response: Disagreed. In the rejection, the examiner stated, 
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"It would have been obvious at the tinne the invention was made to one of 
ordinary skill in the art to modify the password circuitry of Mcintosh 
according to the teaching of Noll, by including a random number generator 
to generate random passwords/PINs for the user for purposes of gaining 
access to his/her secure accounts so that when it comes time for the user 
to either choose a password, or to change a password, the password can 
be randomly generated. The addition of a random password generator as 
taught by Noll would sen/e to provide a "completely random password" 
which "presents no opening or prior knowledge that can be exploited by an 
hostile agent" (Noll, column 1, line 50)." 



In terms of the actual combination of teachings, and particularly the modification, it is 
noted that Mcintosh already teaches the association of passwords with user indicia. 
This structure is already in the Mcintosh reference. Noll "teaches" a random number 
generator to generate random passwords for the express purpose of gaining access to 
secure accounts. Thus, in terms of "structure", Noll teaches a random number 
generator. In the Mcintosh and Noll combination, Mcintosh is modified, according to the 
"teaching" of Noll, to include a random number generator in order to randomly generate 
a password for association with the indicia (rather than making-up a password on the 
spot). Regarding motivation for this combination, it comes directly from Noll as quoted 
above. This combination is proper, the references are analogous, and the motivation is 
solid and well founded. 



The 103 Reiections in view of the archived PassMan website 



Applicant's arguments, at response pages 8-9, with respect to the viability of the 
PassMan website as prior art have been fully considered and are persuasive. The prior 
art rejections based on and involving this reference have been withdrawn. The archived 
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PassMan website was relied upon as prior art meeting the requirements of 35 USC 
1 12(a), as part of a multiple-reference combination under 35 USC 103(a). Prior art 
under 102(a) can be evidence that invention "was known or used by others in this 
country" before the invention thereof by the applicant for a patent; and this prior art can 
be used as part of a 103 rejection. An archived website IS valid prior art. The SOLE 
reason for withdrawal of PassMan as a reference is as follows: Pages 8-1 1 as provided 
to the applicant were archived on September 22, 1999 a couple of months after the 
applicants filing date. While it appears that the PassMan software (based on the 
wayback machine capture dates) was in use and on sale well before applicant's filing, 
details of what the software did at that time is not available to the examiner. Thus, the 
rejection is withdrawn for the time being. 

The Declaration Under 37 C.F.R. §1.131 

The declaration has been review and accepted. However, the presence of the 
declaration is moot because the PassMan art has been withdrawn by the examiner for 
the reasons cited above. 

Conclusion 

13. THIS ACTION IS MADE FINAL Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 . 1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
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TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 



14. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Brian P. Werner whose telephone number is 703-306- 
3037. The examiner can normally be reached on M-F. 8:00 - 4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Leo H. Boudreau can be reached on 703-305-4706. The fax phone 
numbers for the organization where this application or proceeding is assigned are 703- 
872-9314 for regular communications and 703-872-9314 for After Final 
communications. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the receptionist whose telephone number is 703-305- 
4750. 

Brian Werner 
Primary Examiner 
December 31, 2003 
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